REMORSE21 OCT 2026 / PHP
Critical remote code execution
PHP published fixes for CVE-2026-109618 and CVE-2026-109619. Confirm the update in the runtime serving your website, not just the command-line binary.
Read the security advisoryPHP SECURITY / REMOTE ENGINEERING
PHP risk is real.
Know your
next step.
If you cannot confirm the patch, check now. We help you establish what is running, apply the right changes, and verify the result.
Scope, cost and start time agreed before work. No credentials needed for the first inquiry.
Remote service from South KoreaBackup and rollback planningVerification and written handover
WHY CHECK NOW
The vulnerability is real.
Your exposure needs checking.
A public advisory is a reason to investigate your setup. It does not tell us whether your server has been compromised.
23 OCT 2026 / PHP
Check session upload progress too
The follow-up advisory concerns particular session configurations. Review the affected conditions and mitigation; an earlier patched version alone does not settle this check.
Read the follow-up advisorySTART WITH WHAT YOU KNOW
What needs attention
on your site?
A short, self-reported check. No server connection, vulnerability scan or data submission.
- Find the actual runtimeHosting panels and vendor change logs are useful. Do not publish phpinfo() output.
- Separate uncertainty from an incidentUnknown patch status calls for verification. Unexpected file changes call for evidence preservation.
- Take a useful brief into the conversationYour answers can be included in an email draft. You decide whether to send it.
CLEAR SCOPE, CHECKABLE WORK
From the first check
to a working, verified change.
Patch & configuration review
For a supported PHP branch with an update or configuration gap.
- Confirm runtime and vendor patch status
- Plan backup, rollback and restart
- Check core website functions after changes
Legacy PHP upgrade
For an unsupported branch or an application that needs compatibility work.
- Review code, extensions and dependencies
- Agree a staged migration and test scope
- Document remaining issues and next steps
Suspected incident support
When unexpected files, requests or changes suggest a possible compromise.
- Prioritize evidence and access containment
- Agree investigation and recovery scope
- Escalate specialist forensic needs when required
Node.js patching & upgrades
For web services, APIs, bots and crawlers. We check the running Node.js runtime and affected conditions before planning an update.
- Review runtime versions across agreed deployment targets
- Plan backup, rollback, rebuild and redeployment
- Verify service startup and agreed application functions
Every engagement starts with a scope review. International work is quoted individually; currency, taxes, payment terms and the delivery schedule are confirmed in writing.
BEFORE WE TOUCH PRODUCTION
You know what will change.
Understand
Confirm your environment, access constraints and evidence.
Agree
Set the scope, quote, timing, backup and rollback plan.
Apply
Carry out the agreed patch, configuration or migration work.
Verify
Check the runtime and key functions; hand over the results and remaining risks.
Before you get in touch
Does this check scan my server?
No. The result uses your answers in this browser. We have not connected to your website or established whether it is compromised.
My hosting provider manages PHP. Can you help?
Yes. Start by asking the provider for the web runtime and patch record. We can review the evidence and identify changes you or the provider can make.
Will my website go offline?
A runtime change or restart can interrupt service. We agree the maintenance window and rollback plan after reviewing your setup.
Can you guarantee recovery or an immediate start?
Availability, investigation scope and start time are confirmed after we receive your inquiry. No recovery guarantee or continuous monitoring service is implied.
What if I see suspicious files or altered payment pages?
Preserve logs and other evidence before a routine restart or cleanup. Restrict exposure where safe, and involve your hosting provider or incident-response contact. Do not send secrets or customer data in the first email.
LET’S ESTABLISH THE NEXT STEP
Tell us what you know.
We’ll work from there.
Your PHP or Node.js version, hosting setup and what changed are a useful start. A bot or crawler does not need a public website URL.
hello@vrpinc.com